Skip to main content
affpapa.org
RU EN
skill CX Codex

render-domains — Claude Code skill: custom domains and TLS on Render

Walks you through pointing a custom domain at a Render service: DNS records, apex and wildcard setups, TLS certificate issuance. Useful once the app is live but still sitting on onrender.com.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add render-oss/skills --skill render-domains -a claude-code
Open on GitHub

What render-domains does

The skill covers attaching a custom domain to a Render web service or static site. It lays out the order of steps: add the domain in the Dashboard, create the DNS record at your provider, hit Verify. A subdomain takes a CNAME to <service>.onrender.com; an apex on Cloudflare uses the same CNAME flattened, while other providers need an A record with the IP from the Dashboard. Wildcard domains get their own table, since they need three CNAMEs, including _acme-challenge and _cf-custom-hostname.

Render issues and renews certificates itself, through Let's Encrypt and Google Trust Services, and redirects all HTTP to HTTPS. The failure mode is quiet. If your domain carries CAA records, add letsencrypt.org and pki.goog to them, or certificate issuance just won't happen. Leftover AAAA records are the other common culprit: Render runs on IPv4, so clear the IPv6 entries for the domain.

There's a section on disabling the onrender.com subdomain once a custom domain is live. Requests to it start returning 404, and you can turn it back on whenever. In render.yaml domains go in the domains field, but that only declares the association; DNS is still configured by hand at your provider. One thing to check before you start: custom domains work on web services and static sites only, so a private service can't take one.

What it helps with

  • point a custom domain at a Render service
  • create the right CNAME or A record at a registrar
  • set up a wildcard domain for all subdomains
  • debug a TLS certificate that never gets issued
  • disable the onrender.com address after moving to your own domain

Example prompts for the agent

  • add app.example.com to my Render web service and tell me which DNS records to create
  • the certificate for example.com never issues, check the CAA and AAAA records
  • set up a wildcard *.example.com for this service and disable onrender.com

How to install render-domains

1Skills CLI (Vercel)

npx skills add render-oss/skills --skill render-domains -a claude-code

2Manually: put the files in place

~/.claude/skills/render-domains/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/render-domains/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about render-domains

How do I install render-domains in Claude?

Run npx skills add render-oss/skills --skill render-domains -a claude-code. The skill lands in ~/.claude/skills/render-domains/SKILL.md.

What does render-domains do?

It guides you through adding a custom domain on Render: the Dashboard step, DNS records, verification and TLS certificate issuance. It also covers wildcard domains and the usual reasons domain verification fails.

Which Render services support custom domains?

Web services and static sites only. You can't attach a domain to a private service.

Source text

SKILL.md · MIT 
---
name: render-domains
description: >-
  Configures custom domains and TLS certificates on Render—DNS setup, CNAME
  records, apex domains, wildcard domains, and certificate troubleshooting.
  Use when the user needs to add a custom domain, configure DNS, set up
  HTTPS/TLS, troubleshoot certificate issuance, disable the onrender.com
  subdomain, or add a wildcard domain.
  Trigger terms: custom domain, DNS, CNAME, TLS, SSL, HTTPS, certificate,
  apex domain, wildcard domain, onrender.com, domain verification.
license: MIT
compatibility: Render web services and static sites
metadata:
  author: Render
  version: "1.0.0"
  category: networking
---

# Render Custom Domains

Render automatically provisions and renews TLS certificates (via Let's Encrypt and Google Trust Services) for all custom domains. All HTTP traffic is redirected to HTTPS. Custom domains work on **web services** and **static sites** only.

## When to Use

- Adding a **custom domain** to a web service or static site
- Configuring **DNS records** (CNAME, A, or ALIAS) with a provider
- Setting up a **wildcard domain** (`*.example.com`)
- Troubleshooting **certificate issuance** or **domain verification** failures
- Choosing between **apex** (`example.com`) and **www** (`www.example.com`)
- **Disabling the `onrender.com` subdomain** after adding a custom domain

## Domain Limits and Cost

Workspace plans include a limited number of custom domains. Adding domains beyond the included allowance incurs an additional cost. Confirm current allowances and charges at [Render pricing](https://render.com/pricing) or in the Dashboard.

## Setup Steps

### 1. Add domain in Dashboard

1. Go to your service's **Settings > Custom Domains**
2. Click **+ Add Custom Domain**
3. Enter your domain (e.g. `app.example.com`)
4. Click **Save**

Adding a `www` subdomain automatically adds the root domain (and vice versa) with a redirect between them.

### 2. Configure DNS

Add a DNS record with your provider pointing to your Render service:

| Domain type | Record type | Name | Value |
|-------------|-------------|------|-------|
| **Subdomain** (`app.example.com`) | CNAME | `app` | `<service>.onrender.com` |
| **Apex** (`example.com`) on Cloudflare | CNAME (flattened) | `@` | `<service>.onrender.com` |
| **Apex** on other providers | A | `@` | Use Render-provided IP (see Dashboard) |

**Important:** Remove any `AAAA` (IPv6) records for your domain. Render uses IPv4, and stale `AAAA` records cause unexpected behavior.

Provider-specific guides:
- [Cloudflare](https://render.com/docs/configure-cloudflare-dns)
- [Namecheap](https://render.com/docs/configure-namecheap-dns)
- [Other providers](https://render.com/docs/configure-other-dns)

### 3. Verify domain

Click **Verify** in the Dashboard. If verification fails, DNS may not have propagated yet—wait a few minutes and retry.

Speed up verification by flushing DNS caches:
- [Google Public DNS](https://developers.google.com/speed/public-dns/cache)
- [Cloudflare DNS](https://1.1.1.1/purge-cache/)
- [OpenDNS](https://cachecheck.opendns.com/)

After verification, Render issues a TLS certificate automatically.

## Wildcard Domains

Wildcard domains (`*.example.com`) route all matching subdomains to one service.

Requires **three CNAME records**:

| Name | Value | Purpose |
|------|-------|---------|
| `*` | `<service>.onrender.com` | Routes traffic |
| `_acme-challenge` | `<service-id>.verify.renderdns.com` | Let's Encrypt validation |
| `_cf-custom-hostname` | `<service-id>.hostname.renderdns.com` | Cloudflare DDoS validation |

**Cloudflare users:** If you add `*.example.com` without adding the root domain to Render, disable proxying (gray cloud) for the root domain to avoid routing conflicts.

## CAA Records

If your domain has `CAA` records, add entries for Render's certificate authorities:

```
example.com IN CAA 0 issue "letsencrypt.org"
example.com IN CAA 0 issuewild "letsencrypt.org"
example.com IN CAA 0 issue "pki.goog; cansignhttpexchanges=yes"
example.com IN CAA 0 issuewild "pki.goog; cansignhttpexchanges=yes"
```

Without these, TLS certificate issuance fails silently.

## Disabling the `onrender.com` Subdomain

After adding at least one custom domain, you can disable the default `onrender.com` subdomain:

1. Settings > Custom Domains > **Render Subdomain** > toggle to **Disabled**
2. All requests to the `onrender.com` URL receive a 404
3. Can be re-enabled at any time

## Blueprint Configuration

Custom domains are specified in the `domains` field:

```yaml
services:
  - type: web
    name: api
    runtime: node
    plan: starter
    domains:
      - app.example.com
      - www.example.com
```

Blueprint `domains` only **declare** the domain association. You still need to configure DNS with your provider manually.

## Common Mistakes

| Mistake | Fix |
|---------|-----|
| AAAA records present | Remove all IPv6 AAAA records for the domain |
| CAA records blocking issuance | Add `letsencrypt.org` and `pki.goog` entries |
| Verifying too quickly | Wait 2-5 minutes for DNS propagation, then flush caches |
| Cloudflare proxy + wildcard without root domain | Disable proxying (gray cloud) for the root domain |
| Trying to add domain to a private service | Custom domains only work on web services and static sites |
| 502 after verification | Routing rules are updating — wait a few minutes |

## References

| Document | Contents |
|----------|----------|
| `references/dns-configuration.md` | Provider-specific DNS setup, apex domain options, TTL recommendations |

## Related Skills

- **render-web-services** — Web service configuration, TLS, port binding
- **render-static-sites** — Static site domains, CDN, headers
- **render-blueprints** — `domains` field in `render.yaml`

© Render · MIT · render-oss/skills

Similar skills

All skills for DevOps and infrastructure →
convex-domains convex Walks your agent through DNS records at your registrar, attaching the domain to a Convex app, and rebinding the auth origin. CX Codex +1 35,800installs vercel-networking-domains bobmatnyc A skill that walks the agent through Vercel domains, redirects, rewrites, headers and edge cache. Useful when you change traffic behavior rather than app code. CX Codex +1 344installs huawei-cloud-network-query huaweicloud Read-only queries for Huawei Cloud network resources like VPC, ELB, NAT, and DNS using local Python scripts. Built to inspect topology and security settings without cloud mutations. CX Codex +1 17,000installs configuring-vpc-endpoints-for-private-aws-service-access aws A skill that walks the agent through VPC endpoint setup with AWS PrivateLink, so AWS services stay reachable without an internet gateway or public IPs. CX Codex +1 6,400installs telecommunications-expert personamanagmentlayer A skill that gives your agent telecom expertise: OSS/BSS, 5G, SDN/NFV, standards and charging. Useful when you design a system or work out billing logic. CX Codex +1 1,900installs cloudflare-troubleshooting daymade A skill that diagnoses Cloudflare misconfigurations through API evidence: redirect loops, SSL errors, DNS problems. No guessing. CX Codex +1 942installs

From the same set14

render-blueprints Authors and validates Render Blueprints: wires services to databases and Key Value, sets up projects, environments and previews. Useful when your infra lives in YAML. CX Codex +1 407installs render-docker A skill that teaches your agent to write Dockerfiles and set up container deploys on Render: builds, private registries, layer caching. CX Codex +1 393installs render-background-workers A skill that sets up background workers on Render: wire a queue broker, catch SIGTERM, and keep in-flight jobs alive through a deploy. CX Codex +1 369installs render-static-sites Walks your agent through shipping a static site or SPA to Render's CDN: build commands, publish paths, SPA routing, headers and PR previews. CX Codex +1 367installs render-networking Wires Render services together over the private network: internal DNS names, instance discovery and service-to-service traffic. CX Codex +1 361installs render-keyvalue A skill that walks your agent through provisioning and configuring Render Key Value on Valkey 8 for caching, sessions or job queues. CX Codex +1 357installs render-scaling Sets autoscaling targets, instance counts and compute plans for Render services, and explains the platform limits that block scaling. CX Codex +1 354installs render-private-services A skill that walks your agent through setting up a Render private service: an internal API, gRPC server or microservice with no public URL. CX Codex +1 346installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor